当前位置：文档之家 › rfc5830.GOST 28147-89 Encryption, Decryption,

rfc5830.GOST 28147-89 Encryption, Decryption,

  • 格式：pdf
  • 大小：26.72 KB
  • 文档页数：19

Independent Submission V. Dolmatov, Ed. Request for Comments: 5830 Cryptocom, Ltd. Category: Informational March 2010 ISSN: 2070-1721GOST 28147-89: Encryption, Decryption,and Message Authentication Code (MAC) AlgorithmsAbstractThis document is intended to be a source of information about theRussian Federal standard for electronic encryption, decryption, andmessage authentication algorithms (GOST 28147-89), which is one ofthe Russian cryptographic standard algorithms called GOSTalgorithms). Recently, Russian cryptography is being used inInternet applications, and this document has been created asinformation for developers and users of GOST 28147-89 for encryption, decryption, and message authentication.Status of This MemoThis document is not an Internet Standards Track specification; it is published for informational purposes.This is a contribution to the RFC Series, independently of any other RFC stream. The RFC Editor has chosen to publish this document atits discretion and makes no statement about its value forimplementation or deployment. Documents approved for publication by the RFC Editor are not a candidate for any level of InternetStandard; see Section 2 of RFC 5741.Information about the current status of this document, any errata,and how to provide feedback on it may be obtained at/info/rfc5830.Dolmatov Informational [Page 1]Copyright NoticeCopyright (c) 2010 IETF Trust and the persons identified as thedocument authors. All rights reserved.This document is subject to BCP 78 and the IETF Trust’s LegalProvisions Relating to IETF Documents(/license-info) in effect on the date ofpublication of this document. Please review these documentscarefully, as they describe your rights and restrictions with respect to this document.This document may not be modified, and derivative works of it may not be created, except to format it for publication as an RFC or totranslate it into languages other than English.Table of Contents1. Introduction (3)1.1. General Information (3)2. Applicability (3)3. Definitions and Notations (3)3.1. Definitions (3)3.2. Notation (4)4. General Statements (4)5. The Electronic Codebook Mode (6)5.1. Encryption of Plain Text in the Electronic Codebook Mode (6)5.2. Decryption of the Ciphertext in the ElectronicCodebook Mode (9)6. The Counter Encryption Mode (10)6.1. Encryption of Plain Text in the Counter Encryption Mode (10)6.2. Decryption of Ciphertext in the Counter Encryption Mode (13)7. The Cipher Feedback Mode (13)7.1. Encryption of Plain Text in the Cipher Feedback Mode (13)7.2. Decryption of Ciphertext in the Cipher Feedback Mode (14)8. Message Authentication Code (MAC) Generation Mode (15)9. Security Considerations (17)10. Normative References (17)Appendix A. Values of the Constants C1 and C2 (18)Appendix B. Contributors (19)Dolmatov Informational [Page 2]1. Introduction1.1. General Information[GOST28147-89] is the unified cryptographic transformation algorithm for information processing systems of different purposes, definingthe encryption/decryption rules and the message authentication code(MAC) generation rules.This cryptographic transformation algorithm is intended for hardware or software implementation and corresponds to the cryptographicrequirements. It puts no limitations on the encrypted informationsecrecy level.2. ApplicabilityGOST 28147-89 defines the encryption/decryption model and MACgeneration for a given message (document) that is meant fortransmission via insecure public telecommunication channels betweendata processing systems of different purposes.GOST 28147-89 is obligatory to use in the Russian Federation in alldata processing systems providing public services.3. Definitions and Notations3.1. DefinitionsThe following terms are used in the standard:Running key: a pseudo-random bit sequence generated by a givenalgorithm for encrypting plain texts and decrypting encrypted texts. Encryption: the process of transforming plain text to encrypted data using a cipher.MAC: an information string of fixed length that is generated fromplain text and a key according to some rule and added to theencrypted data for protection against data falsification.Key: a defined secret state of some parameters of a cryptographictransformation algorithm, that provides a choice of onetransformation out of all the possible transformations.Cryptographic protection: data protection using the datacryptographic transformations.Dolmatov Informational [Page 3]Cryptographic transformation: data transformation using encryptionand (or) MAC.Decryption: the process of transforming encrypted data to plain text using a cipher.Initialisation vector: initial values of plain parameters of acryptographic transformation algorithm.Encryption equation: a correlation showing the process of generating encrypted data out of plain text as a result of transformationsdefined by the cryptographic transformation algorithm.Decryption equation: a correlation showing the process of generating plain text out of encrypted data as a result of transformationsdefined by the cryptographic transformation algorithm.Cipher: a set of reversible transformations of the set of possibleplain texts onto the set of encrypted data, made after certain rules and using keys.3.2. NotationIn this document, the following notations are used:^ is a power operator.(+) is a bitwise addition of the words of the same length modulo 2. [+] is an addition of 32-bit vectors modulo 2^32.[+]’ is an addition of the 32-bit vectors modulo 2^32-1.1..N is all values from 1 to N.4. General StatementsThe structure model of the cryptographic transformation algorithm (a cryptographic model) contains:- a 256-bit key data store (KDS) consisting of eight 32-bit registers (X0, X1, X2, X3, X4, X5, X6, X7);- four 32-bit registers (N1, N2, N3, N4);- two 32-bit registers (N5 and N6) containing constants C1 and C2;- two 32-bit adders modulo 2^32 (CM1, CM3);Dolmatov Informational [Page 4]- a 32-bit adder of bitwise sums modulo 2 (CM2);- a 32-bit adder modulo (2^32-1) (CM4);- an adder modulo 2 (CM5), with no limitation to its width;- a substitution box (K);- a register for a cyclic shift of 11 steps to the top digit (R).A substitution box (S-box) K consists of eight substitution pointsK1, K2, K3, K4, K5, K6, K7, K8, with 64-bit memory. A 32-bit vector coming to the substitution box is divided into eight successive 4-bit vectors, and each of them is transformed into a 4-bit vector by acorresponding substitution point. A substitution point is a tableconsisting of 16 lines, each containing four bits. The incomingvector defines the line address in the table, and the contents ofthat line is the outgoing vector. Then, these 4-bit outgoing vectors are successively combined into a 32-bit vector.Remark: the standard doesn’t define any S-boxes. Some of them aredefined in [RFC4357].When adding and cyclically shifting binary vectors, the registerswith larger numbers are considered the top digits.When writing a key (W1, W2, ..., W256), Wq = 0..1, q = 1..256, in the KDS the value:- W1 is written into the 1st bit of the register X0;- the value W2 is written into the 2nd bit of the register X0 (etc.); - the value W32 is written into the 32nd bit of the register X0;- the value W33 is written into the 1st bit of the register X1;- the value W34 is written into the 2nd bit of the register X1(etc.);- the value W64 is written into the 32nd bit of the register X1;- the value W65 is written into the 1st bit of the register X2(etc.);- the value W256 is written into the 32nd bit of the register X7. Dolmatov Informational [Page 5]When rewriting the information, the value of the p-th bit of oneregister (adder) is written into the p-th bit of another register(adder).The values of the constants C1 and C2 in the registers N5 and N6 are in the Appendix 1.The keys defining fillings of KDS and the substitution box K tablesare secret elements and are provided in accordance with theestablished procedure.The filling of the substitution box K is described in GOST 28147-89as a long-term key element common for a whole computer network.Usually, K is used as a parameter of algorithm, some possible sets of K are described in [RFC4357].The cryptographic model contemplates four working modes:- data encryption (decryption) in the electronic codebook (ECB) mode, - data encryption (decryption) in the counter (CNT) mode,- data encryption (decryption) in the cipher feedback (CFB) mode, and - the MAC generation mode.[RFC4357] also describes the CBC mode of GOST 28147-89, but this mode is not a part of the standard.5. The Electronic Codebook Mode5.1. Encryption of Plain Text in the Electronic Codebook ModeThe plain text to be encrypted is split into 64-bit blocks. Input of a binary data block Tp = (a1(0), a2(0), ... , a31(0), a32(0), b1(0), b2(0), ..., b32(0)) into the registers N1 and N2 is done so that the value of a1(0) is put into the first bit of N1, the value of a2(0) is put into the second bit of N1, etc., and the value of a32(0) is putinto the 32nd bit of N1. The value of b1(0) is put into the firstbit of N2, the value of b2(0) is put into the 2nd bit of N2, etc.,and the value of b32(0) is input into the 32nd bit of N2.The result is the state (a32(0), a31(0), ..., a2(0), a1(0)) of theregister N1 and the state (b32(0), b31(0), ..., b1(0)) of theregister N2.The 256 bits of the key are entered into the KDS. The contents ofeight 32-bit registers X0, X1, ..., X7 are:Dolmatov Informational [Page 6]X0 = W32, W31, ..., W2, W1X1 = W64, W63, ..., W34, W33. . . . . . . . . . . . . . .X7 = W256, W255, ..., W226, W225The algorithm for enciphering 64-bit blocks of plain text in theelectronic codebook mode consists of 32 rounds.In the first round, the initial value of register N1 is added modulo 2^32 in the adder CM1 to the contents of the register X0. Note: the value of register N1 is unchanged.The result of the addition is transformed in the substitution blockK, and the resulting vector is put into the register R, where it iscyclically shifted by 11 steps towards the top digit. The result of this shift is added bitwise modulo 2 in the adder CM2 to the 32-bitcontents of the register N2. The result produced in CM2 is thenwritten into N1, and the old contents of N1 are written in N2. Thus, the first round ends.The subsequent rounds are similar to the first one:- in the second round, the contents of X1 are read from the KDS;- in the third round, the contents of X2 are read from the KDS, etc.; - in the 8th round, the contents of X7 are read from the KDS.- in rounds 9 through 16 and 17 through 24, the contents of the KDSare read in the same order:X0, X1, X2, X3, X4, X5, X6, X7.- in the last eight rounds from the 25th to the 32nd, the contents of the KDS are read backwards:X7, X6, X5, X4, X3, X2, X1, X0.Thus, during the 32 rounds of encryption, the following order ofchoosing the registers’ contents is implemented:X0, X1, X2, X3, X4, X5, X6, X7, X0, X1, X2, X3, X4, X5, X6, X7,X0, X1, X2, X3, X4, X5, X6, X7, X7, X6, X5, X4, X3, X2, X1, X0 Dolmatov Informational [Page 7]In the 32nd round, the result in the adder CM2 is written into theregister N2, and the old contents of register N1 are unchanged.After the 32nd round, the contents of the registers N1 and N2 are an encrypted data block corresponding to a block of plain text.The equations for enciphering in the electronic codebook mode are:|a(j) = (a(j-1) [+] X(j-1)(mod 8))*K*R (+) b (j-1)| j = 1..24; |b(j) = a(j-1)|a(j) = (a(j-1) [+] X(32-j))*K*R (+) b(j-1)| j = 25..31; a32 = a31; |b(j) = a(j-1)b(32) = (a(31) [+] X0)*K*R (+) b(31) j=32, where:a(0) = (a32(0), a31(0), ..., a1(0)) constitutes the initial contents of N1 before the first round of encryption;b(0) = (b32(0), b31(0), ..., b1(0)) constitutes the initial contents of N2 before the first round of encryption;a(j) = (a32(j), a31(j), ..., a1(j)) constitutes the contents of N1after the j-th round of encryption;b(j) = (b32(j), b31(j), ..., b1(j)) constitutes the contents of N2after the j-th round of encryption, j = 1..32.R is the operation of cyclic shift towards the top digit by 11 steps, as follows:R(r32, r31, r30, r29, r28, r27, r26, r25, r24, r23, r22, r21,r20, ..., r2, r1) =(r21, r20, ..., r2, r1, r32, r31, r30, r29, r28, r27, r26, r25,r24, r23, r22)The 64-bit block of ciphertext Tc is taken out of the registers N1,N2 in the following order:the first, second, ..., 32nd bit of the register N1, then the first, second, ..., 32nd bit of the register N2, i.e.,Tc = a1(32), a2(32), ..., a32(32), b1(32), b2(32), ..., b32(32)). Dolmatov Informational [Page 8]The remaining blocks of the plain text in electronic codebook modeare encrypted in the same fashion.5.2. Decryption of the Ciphertext in the Electronic Codebook ModeThe same 256-bit key that was used for encryption is loaded into the KDS, the encrypted data to be deciphered is divided into 64-bitblocks. The loading of any binary information blockTc = (a1(32), a2(32), ..., a32(32), b1(32), b2(32), ..., b32(32)) into the registers N1 and N2 is done in such a way that:- the contents of a1(32) are written into the first bit of N1;- the contents of a2(32) are written into the second bit of N1 (andso on);- the contents of a32(32) are written into the 32nd bit of N1;- the contents of b1(32) are written into the first bit of N2 (and so on);- and the contents of b32(32) are written into the 32nd bit of N2.The decryption procedure uses the same algorithm as the encryption of plain text, with one exception: the contents of the registers X0, X1, ..., X7 are read from the KDS in the decryption rounds in thefollowing order:X0,X1,X2,X3,X4,X5,X6,X7, X7,X6,X5,X4,X3,X2,X1,X0,X7,X6,X5,X4,X3,X2,X1,X0, X7,X6,X5,X4,X3,X2,X1,X0.The decryption equations are:|a(32-j) = (a(32-j+1) [+] X(j-1))*K*R (+) b(32-j+1)| j = 1..8; |b(32-1) = a(32-j+1)|a(32-j) = (a(32-j+1) [+] X(j-1)(mod 8))*K*R (+) b(32-j+1)| j = 9..31; |b(32-1) = a(32-j+1)|a(0) = a(1)| j=32. |b(0) = (a(1) [+] X0)*K*R (+) b1Dolmatov Informational [Page 9]The fillings of the adders N1 and N2 after 32 working rounds are aplain text block.Tp = (a1(0), a2(0), ... , a32(0), b1(0), b2(0), ..., b32(0))corresponding to the encrypted data block:- the value of a1(0) of the block Tp corresponds to the contents ofthe first bit of N1;- the value of a2(0) corresponds to the contents of the second bit of N1 (etc.);- the value of b1(0) corresponds to the contents of the first bit of N2;- the value of b2(0) corresponds to the contents of the second bit of N2 (etc.);- the value of b32(0) corresponds to the contents of 32nd bit of N2; - the remaining blocks of encrypted data are decrypted similarly.The encryption algorithm in the electronic codebook mode of a 64-bit block Tp is denoted by A, that is:A(Tp) is A(a(0), b(0)) = (a(32), b(32)) = Tc.6. The Counter Encryption Mode6.1. Encryption of Plain Text in the Counter Encryption ModeThe plain text divided into 64-bit blocks Tp(1), Tp(2), ..., Tp(M-1), Tp(M) is encrypted in the counter encryption mode by bitwise addition modulo 2 in the adder CM5 with the running key Gc produced in 64-bit blocks, that is:Gc = (Gc(1), Gc(2), ..., Gc(M-1), Gc(M))where M is defined by the size of the plain text being encrypted.Gc(i) is the i-th 64-bit block where i=1..M, the number of bits in a block Tp(M) can be less than 64. In this case, the unused part ofthe running key block Gc(M) is discarded.Dolmatov Informational [Page 10]256 bits of the key are put into the KDS. The registers N1 and N2accept a 64-bit binary sequence (an initialisation vector) S = (S1,S2, ..., S64), that is, the initial filling of these registers forsubsequent generation of M blocks of the running key. Theinitialisation vector is put into the registers N1 and N2 so:- the value of S1 is written into the first bit of N1;- the value of S2 is written into the second bit of N1 (etc.);- the value of S32 is written into the 32nd bit of N1;- the value of S33 is written into the first bit of N2;- the value of S34 is written into the 33th bit of N2 (etc.);- the value of S64 is written into the 32nd bit of N2.The initial filling of the registers N1 and N2 (the initialisationvector S) is encrypted in the electronic codebook mode in accordance with the requirements from section 5.1. The result of thatencryption A(S) = (Y0, Z0) is rewritten into the 32-bit registers N3 and N4 so as the contents of N1 are written into N3, and the contents of N2 are written into N4.The filling of the register N4 is added modulo (2^32-1) in the adder CM4 to the 32-bit constant C1 from the register N6; the result iswritten into N4. The filling of the register N3 is added modulo 2^32 in the adder CM3 with the 32-bit constant C2 from the register N5;the result is written into N3.The filling of N3 is copied into N1, and the filling of N4 is copied into N2, while the fillings of N3 and N4 are kept.The filling of N1 and N2 is encrypted in the electronic codebook mode according to the requirements of section 5.1. The resultingencrypted filling of N1 and N2 is the first 64-bit block of therunning key Gc(1), this block is bitwise added modulo 2 in the adder CM5 with the first 64-bit block of the plain text:Tp(1) = (t1(1), t2(1), ..., t63(1), t64(1)).The result of this addition is a 64-bit block of the encrypted data: Tc(1) = (tau1(1), tau2(1), ..., tau63(1), tau64(1)).Dolmatov Informational [Page 11]The value of tau1(1) of the block Tc(1) is the result of the addition of modulo 2 in the CM5 the value t1(1) of the block Tp(1) to thevalue of the first bit of N1; the value of tau2(1) of the block Tc(1) is the result of addition modulo 2 in the CM5 the value of t2(1) from the block Tp(1) to the value of the second bit of N1, etc.; the value of tau64(1) of the block Tc(1) is the result of addition modulo 2 in the CM5 of the value t64(1) of the block Tp(1) to the value of the32nd bit of N2.To get the next 64-bit block of the running key Gc(2), the filling of N4 is added modulo (2^32-1) in the adder CM4 with the constant C1from N6; the filling of N3 is added modulo 2^32 in the adder CM3 with the constant C2 from N5. The new filling of N3 is copied into N1;the new filling of N4 is copied into N2; the fillings of N3 and N4are kept.The filling of N1 and N2 is encrypted in the electronic codebook mode according to the requirements of section 5.1. The resultingencrypted filling of N1 and N2 is the second 64-bit block of therunning key Gc(2); this block is bitwise added modulo 2 in the adder CM5 with the first 64-bit block of the plain text Tp(2). Theremaining running key blocks Gc(3), Gc(4), ..., Gc(M) are generatedand the plain text blocks Tp(3), Tp(4), ..., Tp(M) are encryptedsimilarly. If the length of the last M-th block of the plain text is less than 64 bits, then only the corresponding number of bits fromthe last M-th block of the running key is used; remaining bits arediscarded.The initialisation vector S and the blocks of encrypted data Tc(1),Tc(2), ..., Tc(M) are transmitted to the telecommunication channel or to the computer memory.The encryption equation is:Tc(i) = A(Y[i-1] [+] C2, Z[i-1]) [+]’ C1) (+) Tp(i)= Gc(i) (+) Tp(i) i=1..Mwhere:Y[i] is the contents of the register N3 after encrypting thei-th block of the plain text Tp(i);Z(i) is the contents of the register N4 after encrypting thei-th block of the plain text Tp(i);(Y[0], Z[0]) = A(S).Dolmatov Informational [Page 12]6.2. Decryption of Ciphertext in the Counter Encryption Mode256 bits of the key that was used for encrypting the data Tp(1),Tp(2), ..., Tp(M) are put into the KDS. The initialisation vector S is put into the registers N1 and N2 and, like in the section 6.1 Mblocks of the running key, Gc(1), Gc(2), ..., Gc(M) are generated.The encrypted data blocks Tc(1), Tc(2), ..., Tc(M) are added bitwise modulo 2 in the adder CM5 with the blocks of the running key, andthis results in the blocks of plain text Tp(1), Tp(2), ..., Tp(M),and Tp(M) may contain less than 64 bit.The decryption equation is:Tp(i) = A (Y[i-1] [+] C2, Z[i-1] [+]’ C1) (+) Tc(i)= Gc(i) (+) Tc(i) i = 1..M7. The Cipher Feedback Mode7.1. Encryption of Plain Text in the Cipher Feedback ModeThe plain text is divided into 64-bit blocks Tp(1), Tp(2), ..., Tp(M) and encrypted in the cipher feedback mode by bitwise addition modulo 2 in the adder CM5 with the running key Gc generated in 64-bitblocks, i.e., Gc(i)=(Gc(1), Gc(2), ..., Gc(M)), where M is defined by ___the length of the plain text, Gc(i) is the i-th 64-bit block, i=1,M. The number of bits in the block Tp(M) may be less than 64.256 bits of the key are put into the KDS. The 64-bit initialisation vector S = (S1, S2, ..., S64) is put into N1 and N2 as described insection 6.1.The initial filling of N1 and N2 is encrypted in the electroniccodebook mode in accordance with the requirements in section 6.1. If resulting encrypted filling N1 and N2 is the first 64-bit block ofthe running key Gc(1)=A(S), then this block is added bitwise modulo 2 with the first 64-bit block of plain text Tp(1) = (t1(1), t2(1), ..., t64(1)).The result is a 64-bit block of encrypted dataTc(1) = (tau1(1), tau2(1), ..., tau64(1)).The block of encrypted data Tc(1) is simultaneously the initial state of N1 and N2 for generating the second block of the running key Gc(2) and is written on feedback in these registers. Here:- the value of tau1(1) is written into the first bit of N1;Dolmatov Informational [Page 13]- the value of tau2(1) is written into the second bit of N1, etc.;- the value of tau32(1) is written into the 32nd bit of N1;- the value of tau33(1) is written into the first bit of N2;- the value of tau34(1) is written into the second bit of N2, etc.;- the value of tau64(1) is written into the 32nd bit of N2.The filling of N1 and N2 is encrypted in the electronic codebook mode in accordance with the requirements in the section 6.1. Theencrypted filling of N1 and N2 makes the second 64-bit block of therunning key Gc(2), this block is added bitwise modulo 2 in the adder CM5 to the second block of the plain text Tp(2).The generation of subsequent blocks of the running key Gc(i) and the encryption of the corresponding blocks of the plain text Tp(i) (i =3..M) are performed similarly. If the length of the last M-th block of the plain text is less than 64 bits, only the corresponding number of bits of the M-th block of the running key Gc(M) is used; remaining bits are discarded.The encryption equations in the cipher feedback mode are:|Tc(1) = A(S) (+) Tp(1) = Gc(1) (+) Tp(1)||Tc(i) = A(Tc(i-1)) (+) Tp(i) = Gc(i) + Tp(i), i = 2..M.The initialisation vector S and the blocks of encrypted data Tc(1),Tc(2), ..., Tc(M) are transmitted into the telecommunication channel or to the computer memory.7.2. Decryption of Ciphertext in the Cipher Feedback Mode256 bits of the key used for the encryption of Tp(1), Tp(2), ...,Tp(M) are put into the KDS. The initialisation vector S is put into N1 and N2 similar to 6.1.The initial filling of N1 and N2 (the initialisation vector S) isencrypted in the electronic codebook mode in accordance with thesubsection 6.1. The encrypted filling of N1, N2 is the first blockof the running key Gc(1) = A(S), this block is added bitwise modulo 2 in the adder CM5 with the encrypted data block Tc(1). This resultsin the first block of plain text Tp(1).Dolmatov Informational [Page 14]The block of encrypted data Tc(1) makes the initial filling of N1, N2 for generating the second block of the running key Gc(2). The block Tc(1) is written in N1 and N2 in accordance with the requirements in the subsection 6.1, the resulted block Gc(2) is added bitwise modulo 2 in the adder CM5 to the second block of the encrypted data Tc(2).This results in the block of plain text Tc(2).Similarly, the blocks of encrypted data Tc(2), Tc(3), ..., Tc(M-1)are written in N1, N2 successively, and the blocks of the running key Gc(3), Gc(4), ..., Gc(M) are generated out of them in the electronic codebook mode. The blocks of the running key are added bitwisemodulo 2 in the adder CM5 to the blocks of the encrypted data Tc(3), Tc(4), ..., Tc(M), this results in the blocks of plain text Tp(3),Tp(4), ..., Tp(M); here, the number of bits in the last block of the plain text Tp(M) can be less than 64 bit.The decryption equations in the cipher feedback mode are:|Tp(1) = A(S) (+) Tc(1) = Gc(1) (+) Tc(1)||Tp(1) = A(Tc(i-1)) (+) Tc(i) = Gc(i) (+) Tc(i), i=2..M8. Message Authentication Code (MAC) Generation ModeTo provide the protection from falsification of plain text consisting of M 64-bit blocks Tp(1), Tp(2), ..., Tp(M), M >= 2, an additionall-bit block is generated (the message authentication code I(l)). The process of MAC generation is the same for all theencryption/decryption modes.- The first block of plain text:Tp(1) = (t1(1), t1(2), ..., t64(1)) = (a1(1)[0], a2(1)[0], ...,a32(1)[0], b1(1)[0], b2(1)[0], ..., b32(1)[0])is written to the registers N1 and N2;- the value of t1(1) = a1(1)[0] is written into the first bit of N1; - the value of t2(1) = a2(1)[0] is written into the second bit of N1, etc.;- the value of t32(1) = a32(1)[0] is written into the 32nd bit of N1; - the value of t33(1) = b1(1)[0] is written into the first bit of N2, etc.;- the value of t64(1) = b32(1)[0] is written into the 32nd bit of N2. Dolmatov Informational [Page 15]The filling of N1 and N2 is transformed in accordance with the first 16 rounds of the encryption algorithm in the electronic codebook mode (see the subsection 6.1). In the KDS, there exists the same key that is used for encrypting the blocks of plain text Tp(1), Tp(2), ...,Tp(M) in the corresponding blocks of encrypted data Tc(1), Tc(2),..., Tc(M).The filling of N1 and N2 after the 16 working rounds, looking like(a1(1)[16], a2(1)[16], ..., a32(1)[16], b1(1)[16], b2(1)[16], ...,b32(1)[16]), is added in CM5 modulo 2 to the second block Tp(2) =(t1(2), t2(2), ..., t64(2)).The result of this addition(a1(1)[16](+)t1(2), a2(1)[16](+)t2(2), ..., a32(1)[16](+)t32(2), b1(1)[16](+)t33(2), b2(1)[16](+)t34(2), ..., b32(1)[16](+)t64(2)) =(a1(2)[0], a2(2)[0] ..., a32(2)[0], b1(2)[0], b2(2)[0], ...,b32(2)[0])is written into N1 and N2 and is transformed in accordance with thefirst 16 rounds of the encryption algorithm in the electroniccodebook mode.The resulting filling of N1 and N2 is added in the CM5 modulo 2 with the third block Tp(3), etc., the last block Tp(M) = (t1(M), t2(M),..., t64(M)), padded if necessary to a complete 64-bit block byzeros, is added in CM5 modulo 2 with the filling N1, N2 (a1(M-1)[16], a2(M-1)[16], ..., a32(M-1)[16], b1(M-1)[16], b2(M-1)[16], ...,b32(M-1)[16]).The result of the addition(a1(M-1)[16](+)t1(M), a2(M-1)[16](+)t2(M), ..., a32(M-1)[16](+) t32(M), b1(M-1)[16](+)t33(M), b2(M-1)[16](+)t34(M), ...,b32(M-1)[16](+)t64(M))=(a1(M)[0], a2(M)[0] ..., a32(M)[0], b1(M)[0], b2(M)[0], ...,b32(M)[0])is written into N1, N2 and encrypted in the electronic codebook mode after the first 16 rounds of the algorithm’s work. Out of theresulting filling of the registers N1 and N2:Dolmatov Informational [Page 16]。

合集下载

DNSCrypt安全DNS协议

DNSCrypt安全DNS协议

DNSCrypt安全DNS协议DNSCrypt是一种用于加密DNS查询的协议，旨在提供更安全和隐私保护的互联网体验。

通过使用DNSCrypt，用户可以避免DNS欺骗和窥探攻击，确保他们的网络通信得到了保护。

一、什么是DNS？DNS（Domain Name System）是互联网中用于将域名转换为IP地址的系统。

当我们输入一个网址时，计算机会发送一个DNS查询请求，以获取与该域名相关的IP地址。

这是一项基本的互联网功能，负责将人类可读的域名转换为机器可理解的IP地址。

二、DNS存在的安全问题然而，虽然DNS在互联网通信中起着重要的作用，但它也存在一些安全问题。

传统的DNS查询是明文传输的，这意味着任何网络上的观察者都可以截取和查看此查询。

这种明文传输使得DNS查询容易受到欺骗、篡改和窥探攻击。

1. DNS欺骗DNS欺骗是一种攻击方式，在该攻击中，恶意用户可以将用户的DNS查询重定向到一个错误的IP地址，使用户被重定向到虚假的网站。

这可能导致用户的敏感信息泄露或遭受其他网络攻击。

2. 窥探攻击在传统的DNS查询中，网络上的任何人都可以截取和查看DNS查询，这使得他们可以获得用户可能访问的网站列表，甚至可能获取到用户的个人信息。

三、DNSCrypt的工作原理DNSCrypt通过加密DNS查询和响应来提供安全性和隐私保护。

它使用了公钥加密来保护用户的DNS查询免受窥探和篡改。

1. 加密DNS查询当用户的计算机发送DNS查询请求时，DNSCrypt软件会将查询数据进行加密，使用DNSCrypt协议发送给可信赖的DNS服务器。

这样，即使DNS查询被拦截，攻击者也无法获得查询的内容，保护了用户的隐私。

2. 解密DNS响应可信赖的DNS服务器接收到加密的DNS查询后，将其解密并向全球DNS服务器发送非加密的查询请求。

然后，全球DNS服务器返回解密后的响应，该响应由DNSCrypt软件进行加密，以确保在传输过程中不会被窥探或篡改。

K8工具集——精选推荐

K8工具集——精选推荐

K8⼯具集K8⼯具集⽐较全，底部有下载⽹址。

综合⼯具[+] 扫描⼯具 K8Cscan5.3 ⼤型内⽹渗透扫描器内置27个功能,⽀持Cobalt Strike[+] 综合⼯具 K8飞⼑Final.rar[+] K8data.mdb K8飞⼑漏洞数据库20190402[+] K8expList.txt K8飞⼑漏洞利⽤列表提权⼯具[+] 提权⼯具 CVE-2019-0803.exe Win32k漏洞提权⼯具[+] 提权⼯具 iislpe.exe IIS全版本提权(仅限IIS帐户、服务帐户)[+] 提权⼯具 pr.exe pr有参版 pr0⽆参版（巴西烤⾁:国内10年所说的PR或IIS6提权）[+] 提权⼯具 k8uac_20181125[K8].rar ⽬前还⽀持全版本WIN7-Win10[+] 提权⼯具 bypassUAC_Win7_10[K8team].rar 13还是15年？Win10打补丁失效[+] 提权⼯具 bypassUACexe_0419[K8].rar 13年的吧打补丁的WIN7好像不⽀持了[+] 提权⼯具 Lpk提权_K8.rar DLLHijack[+] 提权⼯具 Usp10提权_K8.rar DLLHijack[+] 提权⼯具 MS11-046.exe[+] 提权⼯具 MS11-080.exe[+] 提权⼯具 MS14-068 EXP域内提权神器.rar[+] 提权⼯具 MS15-010提权[K8team]_20150603.rar[+] 提权⼯具 MS15-051提权 CVE-2015-1701_20150525[K8].rar[+] 提权⼯具 MS15-077提权⼯具[K8].rar[+] 提权⼯具 MS16-016提权EXP[K8].rar[+] 提权⼯具 Windows Win32k.sys EPATHOBJ 0day Exploit 提权⼯具 [K8team].rar[+] 提权⼯具 k8downexec.mof[+] 提权⼯具 k8zzz.rar SMB溢出⽀持执⾏⾃定义exe程序[+] 提权⼯具 udf.dll MYSQL udf提权DLL[+] 提权⼯具 ws2help提权_K8.rar[+] 提权⼯具卡巴6.0.2.614提权.exe[+] 提权⼯具⼩红伞 Avira avipbb.sys 提权Exploit_1024[K8].rar[+] 提权⼯具提权Admin2SystemRun_0419[K8].rar[+] 提权⼯具提权GetTrustedInstaller_0419[K8].rar[+] 提权⼯具降权System2AdminRun_0419[K8].rar[+] 提权⼯具⽆NET添加⽤户提权_20140511[K8].rar[+] 提权⼯具 K8_VBS提权脚本免杀⽣成器.rar[+] 进程注⼊ DLL注⼊进程⼯具过UAC[+] 提权⼯具 NV显卡提权NVexploit.rar[+] 提权⼯具 net2.0day.exe[+] 提权⼯具 K8dllhijack.rar DLL却持测试⼯具[+] 提权⼯具 Invoke-MS16-032.ps1[+] Apache 2.2.1.4 mod_isapi exploit.rar漏洞利⽤[+] 漏洞利⽤ K8飞⼑-EXPLOIT内含20个程序EXP（Drupal、Joomla、Wordpress、Vbulletin、Xampp、Zimbra、ThinkPHP、Magento、Discuz）[+] 漏洞利⽤ K8_Struts2_EXP (S2-045、devMode、S2-037、S2-032、S2-020、S2-019、S2-016、S2-013、S2-009、S2-005)[+] 漏洞利⽤ cve-2019-0604 SharePoint RCE exploit[+] 漏洞利⽤ K8_JbossExp.exe Jboss Jmx-console exploit[+] 漏洞利⽤ K8 DotNetNuke DNNspot Store =3.0 GetShell exploit.rar[+] 漏洞利⽤ CVE-2018-2628 Weblogic GetShell EXPLOIT[+] 漏洞利⽤ ColdFusion 8 LFI EXP[+] 漏洞利⽤ K8_TomcatExp_1124[K.8].rar[+] 漏洞利⽤ WordPress 4.2 XSS 0day 20150429[K.8].rar[+] 漏洞利⽤ k8_zabbix_exp_20160820[K.8].rar漏洞利⽤[+] 漏洞利⽤ K8飞⼑-EXPLOIT内含20个程序EXP（Drupal、Joomla、Wordpress、Vbulletin、Xampp、Zimbra、ThinkPHP、Magento、Discuz）[+] 漏洞利⽤ K8_Struts2_EXP (S2-045、devMode、S2-037、S2-032、S2-020、S2-019、S2-016、S2-013、S2-009、S2-005)[+] 漏洞利⽤ K8 DotNetNuke DNNspot Store =3.0 GetShell exploit.rar[+] 漏洞利⽤ CVE-2018-2628 Weblogic GetShell EXPLOIT[+] 漏洞利⽤ ColdFusion 8 LFI EXP[+] 漏洞利⽤ K8_TomcatExp_1124[K.8].rar[+] 漏洞利⽤ WordPress 4.2 XSS 0day 20150429[K.8].rar[+] 漏洞利⽤ k8_zabbix_exp_20160820[K.8].rar漏洞利⽤[+] 漏洞利⽤ K8飞⼑-EXPLOIT内含20个程序EXP（Drupal、Joomla、Wordpress、Vbulletin、Xampp、Zimbra、ThinkPHP、Magento、Discuz）[+] 漏洞利⽤ K8_Struts2_EXP (S2-045、devMode、S2-037、S2-032、S2-020、S2-019、S2-016、S2-013、S2-009、S2-005)[+] 漏洞利⽤ K8 DotNetNuke DNNspot Store =3.0 GetShell exploit.rar[+] 漏洞利⽤ CVE-2018-2628 Weblogic GetShell EXPLOIT[+] 漏洞利⽤ ColdFusion 8 LFI EXP[+] 漏洞利⽤ K8_TomcatExp_1124[K.8].rar[+] 漏洞利⽤ WordPress 4.2 XSS 0day 20150429[K.8].rar[+] 漏洞利⽤ k8_zabbix_exp_20160820[K.8].rar[+] 漏洞利⽤ K8_Ecshop_Exploit[+] 漏洞利⽤ Magento 1.7.0.2 漏洞EXP_20150624[K.8].rar[+] 漏洞利⽤ K8COOKIE.rar Cookie注⼊⼯具[+] 漏洞利⽤ Jboss_invoke_Exp_k8.rar MSF脚本[+] 漏洞利⽤ DB_Owner_GetShell_K8.rar MSSQL DB权限拿SHELL⼯具挂马⼯具[+] 挂马⼯具 K8domainVBS.exe K8域控植⼊脚本⽣成器[+] 挂马⼯具 K8ARPTool.rar 内⽹ARP⼯具批量挂马[+] 挂马⼯具 CHM⽹马⽣成器.exe[+] 0day漏洞 K8飞⼑内置5个0day漏洞利⽤(Word漏洞\IE神洞\WVS\RAR)[+] 0day漏洞 [视频]BT5 MSF JAVA 0day CVE-2013-0422 Exploit Demo By K8team.rar[+] 0day漏洞 [视频]Hacking Team Flash 0day样本(Firefox IE)完美触发_20150707[K8].rar漏洞环境[+] 漏洞环境 K8-ASP注⼊漏洞环境.rar[+] 漏洞环境 k8bbs(php+mysql)注⼊漏洞环境.rar[+] 漏洞环境 K8 SQL强化练习⼯具V1.0_20190301[K8].rar[+] 漏洞环境 K8迷你ASP服务器.exe 绿⾊⼀键启动免杀⼯具[+] 免杀⼯具 scrunBase64 ShellCode免杀加载器(CS & MSF)[+] 免杀⼯具 scrunBase32 ShellCode免杀加载器(CS & MSF)[+] 免杀⼯具 scrun.exe & scrun.py ShellCode免杀加载器(CS & MSF)[+] 免杀⼯具 K8_SC_ENCODE(CS & Msf免杀⼯具).rar[+] 测试⼯具 K8shellcodeLoader.exe Shellcode测试[+] 免杀⼯具 K8随机免杀花指令⽣成器V2.0.exe[+] 免杀⼯具 K8数字签名添加器.exe[+] 捆绑⼯具 K8免杀系统⾃带捆绑器加强版V2.0.EXE远控后门[+] 远控后门 K8_Gh0st_Bin.rar 不免杀漏洞测试上线⽤[+] 远控后门 TeamServer.exe CS中转Win版,⽆需Kali下⽣成cobaltstrike.store⽂件[+] 远控后门 QQ远控 ClientKey 利⽤⼯具.rar 不免杀18年仍然可⽤19年未测估计也还⾏[+] 远控后门 vncdoor.exe VNC后门可正反向[+] 远控后门 k8_SSH_Manage.exe 渗透专⽤SSH(执⾏完后⽴即销毁会话,不像putty保存会话常暴露IP)[+] 连接⼯具 sshcmd.exe 渗透专⽤SSH(执⾏完后⽴即销毁会话,同时清除连接IP)[+] 连接⼯具 sshshell.exe 交互式SSH类似putty保持会话(⽬标显⽰IP⼀直连着)[+] 远控后门 K8⼿机远控电脑V1.1_20121020[K.8].rar[+] 远控后门 JspShellExec CMD下JSP⼀句话连接⼯具[+] 捆绑⼯具 K8_rarBind.rar RAR捆绑⼯具嗅探⼯具[+] 嗅探⼯具 K8getPC.py 内⽹存活主机探测(⽆需端⼝\⽆视防⽕墙)扫描⼯具[+] 扫描⼯具 K8Cscan5.0.rar ⼤型内⽹渗透扫描器内置22个功能,⽀持Cobalt Strike[+] 扫描⼯具 K8PortScan开源跨平台⼤型⽹络端⼝扫描器(Bin: Windows/Kali/SUSE)[+] 扫描插件 K8Cscan Moudle WebLogicScan.rar Weblogic通⽤GetShell[+] 扫描插件 K8Cscan Moudle CiscoScan.rar Cisco思科探测插件[+] 扫描插件 K8Cscan Moudle OSScan2.rar 系统版本探测插件2[+] 扫描插件 K8Cscan Moudle PortScan.cs 端⼝扫描插件源码[+] 扫描插件 K8Cscan Moudle FtpScan.rar Ftp密码扫描插件[+] 扫描插件 K8Cscan Moudle MysqlScan.rar Mysql密码扫描插件[+] 扫描插件 K8Cscan Moudle OnlinePC.rar 存活主机扫描插件[+] 扫描插件 K8Cscan Moudle WebBanner.rar WebBanner标题扫描插件[+] 扫描插件 K8Cscan Moudle WmiScan.rar Wmi扫描Win系统密码插件[+] 扫描⼯具 K8Cscan for SameWeb.rar C段旁站扫描⼯具[+] 扫描⼯具 K8Cscan for SubDomain.rar ⼦域名扫描⼯具[+] 扫描⼯具 cping3.0.rar ⼤型内外⽹渗透主机扫描⼯具[+] 扫描⼯具 K8_C段旁注⼯具6.0[+] 扫描⼯具 s加强版.exe[+] 扫描⼯具 K8openssl批量 Bat版.rar[+] 扫描⼯具 K8破壳SMTP Bat版.rar[+] 扫描⼯具 WPdetection.exe WordPress站点信息获取[+] 扫描⼯具 K8-S2批量.rar Struts2批量⼯具[+] 扫描⼯具 smbcheck.exe MS17-010漏洞检测，cping、cscan批量专⽤数据库[+] 脱库⼯具 K8mysqlCmd.rar Mysql数据库免驱连接⼯具[+] 脱库⼯具 K8_mysql脱裤20170114(千万).php[+] 脱库⼯具 K8Packwebshell.aspx 整站打包⼯具[+] 脱库⼯具 K8outSQL.aspx MSSQL导库⼯具加密解密[+] K8飞⼑⾥⼤量加密解密算法、编码解码、SQL注⼊、XSS等[+] 密码破解 SharpWeb.exe 浏览器帐密读取⼯具(Firefox/Chorme/IE)[+] 密码破解 laZagne.exe 本地密码检索⼯具(⽀持XP/2003)[+] 密码破解 sshtest.exe SSH密码登陆测试可结合Cscan进⾏批量破解[+] 嗅探⼯具 k8ftpsniffer.py FTP[+] 密码破解 K8_DNN_Password_Decrypt_20161110.rar dotnetnuke密码解密⼯具[+] 密码破解 Invoke-Mimikatz.ps1 Mimikatz 20181209[+] 密码破解 mz.exe Mimikatz-2.1.1-20181209 X86 ⼀键版[+] 密码破解 mz64.exe Mimikatz-2.1.1-20181209 X64 ⼀键版[+] 密码破解 K8_FTP爆破PHP脚本20151010.rar 内⽹渗透⽤[+] 密码破解 K8_Mysql爆破PHP脚本20151009.rar 内⽹渗透⽤[+] 密码破解 K8_ipcscan 爆破IPC⾃动种马⼯具+教程.rar[+] 密码破解 weblogic密码解密⼯具(exe & jar)[+] 密码破解 K8fuckVNC.rar k8vncpwd.exe VNC密码解密⼯具[+] 密码破解 K8getTeamViewPWD_20150705[K.8].rar[+] 密码破解 K8正⽅密码解密⼯具_20150801[K.8].rar[+] 密码破解 getBrowserPWD_1124[K.8].rar Firefox\Ghrome 浏览器密码读取⼯具[+] 密码破解 getvpnpwd.exe VPN、ADSL宽带帐密读取⼯具(仅限XP、2003)[+] 密码破解 GetPassword_x64.rar GetPwd_K8.rar ⼀键获取明⽂[+] 密码破解 K8_FuckOneShell ⼀句话密码爆破秒破10万[+] 加密解密 K8Base32_Decode_20161110.rar[+] 斛密⼯具 k8ungzip.exe GZIP ⽤于提取0day⽹马Powershell执⾏PAYLOAD[+] 密码破解 K8FTP密码破解器V2.0_20190301[K8].rar[+] 密码破解 K8Access数据库密码读取器_20190301[K8].rar[+] 加密⼯具 K8_FileHideImg.exe 任意⽂件隐藏⾄图⽚⼯具安全辅助[+] 安全⼯具 K8⽊马病毒后门监视器V3.0.rar 捆绑后门⽊马释放路径、Shell上传路径查看[+] 安全⼯具 K8进程拦截.rar (⽐⽅说访问⽹页浏览器调⽤外站EXE执⾏说明0day来了,⽽且可防⽌⽊马运⾏)[+] 安全⼯具 K8驱动防⽌WebShell提权⼯具.rar (就是说⽆法通过WEBSHELL执⾏任意命令,就算有签名的EXE也不⾏) [+] 辅助⼯具 K8注册表跳转.exe转发代理[+] 端⼝转发 PortTran.rar .NET端⼝转发⼯具[+] 端⼝转发 K8PortMap.exe D7端⼝映射⼯具WebShell[+] 转换⼯具 k8exe2bat.exe 任意⽂件转Bat⼯具(WebShell⽆法上传EXE解决⽅案)[+] 上传⼯具 K8upload_1125[K8].rar 新型⼩马上传⼯具⽀持任意⽂件(内置asp\php\jsp⼩马)[+] 连接⼯具 K8⼀句话ASP⽊马客户端加强程序版.exe[+] WebShell k8cmd.ascx[+] WebShell k8cmd.pl[+] WebShell k8cmd.py[+] WebShell k8飞⼑CMD.jsp[+] WebShell K8飞⼑A专⽤UA⼀句话⽊马.asp[+] WebShell K8飞⼑PHP-专⽤UA⼀句话⽊马.php[+] WebShell K8飞⼑专⽤UA⼀句话⽊马.asxp[+] WebShell shellcode.aspx硬件渗透[+]BadUSB K8飞⼑内含有⼤量Teensy渗透功能脚本⾃⾏研究[+]BadUSB Teensy 兼容所有Windows和Linux系统下载者.ino其它⼯具[+]教程录制 K8屏幕录像⾼压缩率版_20190301[K8].rar[+]系统美化 K8⽂件夹个性设置⼯具.exe[+]系统美化 K8个性桌⾯右键菜单.exe[+]搜索⼯具 K8吉他谱搜索⼯具_20190301[K8].rar[+]系统美化图标提取器.exe[+]系统美化 k8cmd.exe[+]辅助⼯具 K8侠盗猎车4外挂.exe[+]辅助⼯具 K8迅雷、快车、旋风地址互换⼯具.exe注意：只限学习使⽤切勿进⾏破坏。

rfc5930.Using Advanced Encryption Standard Counter Mode (AES-CTR)

rfc5930.Using Advanced Encryption Standard Counter Mode (AES-CTR)

Internet Engineering Task Force (IETF) S. Shen Request for Comments: 5930 Huawei Category: Informational Y. Mao ISSN: 2070-1721 Hangzhou H3C Tech. Co., Ltd. NSS. Murthy Freescale Semiconductor July 2010 Using Advanced Encryption Standard Counter Mode (AES-CTR)with the Internet Key Exchange version 02 (IKEv2) Protocol AbstractThis document describes the usage of Advanced Encryption StandardCounter Mode (AES-CTR), with an explicit Initialization Vector, bythe Internet Key Exchange version 2 (IKEv2) protocol, for encrypting the IKEv2 exchanges that follow the IKE_SA_INIT exchange.Status of This MemoThis document is not an Internet Standards Track specification; it is published for informational purposes.This document is a product of the Internet Engineering Task Force(IETF). It represents the consensus of the IETF community. It hasreceived public review and has been approved for publication by theInternet Engineering Steering Group (IESG). Not all documentsapproved by the IESG are a candidate for any level of InternetStandard; see Section 2 of RFC 5741.Information about the current status of this document, any errata,and how to provide feedback on it may be obtained at/info/rfc5930.Shen, et al. Informational [Page 1]Copyright NoticeCopyright (c) 2010 IETF Trust and the persons identified as thedocument authors. All rights reserved.This document is subject to BCP 78 and the IETF Trust’s LegalProvisions Relating to IETF Documents(/license-info) in effect on the date ofpublication of this document. Please review these documentscarefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e ofthe Trust Legal Provisions and are provided without warranty asdescribed in the Simplified BSD License.Table of Contents1. Introduction (2)1.1. Conventions Used in This Document (3)2. IKEv2 Encrypted Payload (3)3. IKEv2 Conventions (4)4. Security Considerations (4)5. IANA Considerations (4)6. Acknowledgments (4)7. References (5)7.1. Normative References (5)7.2. Informative References (5)1. IntroductionThe Internet Key Exchange version 2 (IKEv2) protocol [RFC4306] is acomponent of IPsec used for performing mutual authentication andestablishing and maintaining security associations (SAs). [RFC4307] defines the set of algorithms that are mandatory to implement as part of IKEv2, as well as algorithms that should be implemented becausethey may be promoted to mandatory at some future time. [RFC4307]requires that an implementation "SHOULD" support Advanced Encryption Standard [AES] Counter Mode [MODES] (AES-CTR) as a Transform Type 1algorithm (encryption).Although [RFC4307] specifies that the AES-CTR encryption algorithmfeature SHOULD be supported by IKEv2, no existing document specifies how IKEv2 can support the feature. This document provides thespecification and usage of AES-CTR Counter Mode by IKEv2.Implementers need to carefully consider the use of AES-CTR over themandatory-to-implement algorithms in [RFC4307], because theperformance improvements of AES-CTR are minimal in the context of Shen, et al. Informational [Page 2]IKEv2. Furthermore, these performance improvements may be offset by the Counter Mode specific risk of a minor, hard-to-detectimplementation issue resulting in total security failure.1.1. Conventions Used in This DocumentThe key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT","SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119].2. IKEv2 Encrypted PayloadSection 3.14 of IKEv2 [RFC4306] explains the IKEv2 Encrypted Payload. The Encrypted Payload, denoted SK{...}, contains other IKEv2 payloads in encrypted form.The payload includes an Initialization Vector (IV) whose length isdefined by the encryption algorithm negotiated. It also includesIntegrity Checksum data. These two fields are not encrypted.The IV field MUST be 8 octets when the AES-CTR algorithm is used for IKEv2 encryption. The requirements for this IV are the same as what is specified for the Encapsulating Security Payload (ESP) inSection 3.1 of [RFC3686].IKEv2 requires Integrity Check Data for the Encrypted Payload asdescribed in Section 3.14 of [RFC4306]. The choice of integrityalgorithms in IKEv2 is defined in [RFC4307] or documents that update it in the future.When AES-CTR is used in IKEv2, no padding is required. The Paddingfield of the Encrypted Payload SHOULD be empty, and the Pad Lengthfield SHOULD be zero. However, according to [RFC4306], the recipient MUST accept any length that results in proper alignment. It shouldbe noted that the ESP [RFC4303] Encrypted Payload requires alignment on a 4-byte boundary while the IKEv2 [RFC4306] Encrypted Payload does not have such a requirement.The Encrypted Payload is the XOR of the plaintext and key stream.The key stream is generated by inputting counter blocks into the AES algorithm. The AES counter block is 128 bits, including a 4-octetNonce, 8-octet Initialization Vector, and 4-octet Block Counter, inthat order. The Block Counter begins with the value of one andincrements by one to generate the next portion of the key stream.The detailed requirements for the counter block are the same as those specified in Section 4 of [RFC3686].Shen, et al. Informational [Page 3]3. IKEv2 ConventionsThe use of AES-CTR for the IKE SA is negotiated in the same way asAES-CTR for ESP. The Transform ID (ENCR_AES_CTR) is the same; thekey length transform attribute is used in the same way; and thekeying material (consisting of the actual key and the nonce) isderived in the same way. See Section 5 of [RFC3686] for detaileddescriptions.4. Security ConsiderationsSecurity considerations explained in Section 7 of [RFC3686] areentirely relevant to this document as well. The securityconsiderations on fresh keys and integrity protection in Section 7 of [RFC3686] are totally applicable to using AES-CTR in IKEv2; see[RFC3686] for details. As static keys are never used in IKEv2 forIKE_SA and integrity protection is mandatory for IKE_SA, these issues are not applicable for AES-CTR in IKEv2 when protecting IKE_SA.Additionally, since AES has a 128-bit block size, regardless of themode employed, the ciphertext generated by AES encryption becomesdistinguishable from random values after 2^64 blocks are encryptedwith a single key. Since IKEv2 SA cannot carry that much data(because of the size limit of the message ID of the IKEv2 message and the requirements for the message ID in Section 4 of [RFC4306]), this issue is not a concern here.For generic attacks on AES, such as brute force or precalculations,the key-size requirements provide reasonable security[Recommendations].5. IANA ConsiderationsIANA [IANA-Para] has assigned an Encryption Algorithm Transform IDfor AES-CTR encryption with an explicit IV for IKEv2: 13 as thenumber, and ENCR_AES_CTR as the name. IANA has added a reference to this RFC in that entry.6. AcknowledgmentsThe authors thank Yaron Sheffer, Paul Hoffman, Tero Kivinen, andAlfred Hoenes for their direction and comments on this document.This document specifies usage of AES-CTR with IKEv2, similar to usage of AES-CTR with ESP as specified in [RFC3686]. The reader isreferred to [RFC3686] for the same descriptions and definitions. The authors thank Russ Housley for providing the document.Shen, et al. Informational [Page 4]During the production and modification of this document, both Huawei and CNNIC supported one of the authors, Sean Shen. Both areappreciated as affiliations of the author.7. References7.1. Normative References[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997. [RFC3686] Housley, R., "Using Advanced Encryption Standard(AES) Counter Mode With IPsec EncapsulatingSecurity Payload (ESP)", RFC 3686, January 2004.[RFC4306] Kaufman, C., "Internet Key Exchange (IKEv2)Protocol", RFC 4306, December 2005.[RFC4307] Schiller, J., "Cryptographic Algorithms for Use in the Internet Key Exchange Version 2 (IKEv2)",RFC 4307, December 2005.[AES] National Institute of Standards and Technology,"Advanced Encryption Standard (AES)", FIPS PUB 197, November 2001, </publications/fips/fips197/fips-197.pdf>.[IANA-Para] Internet Assigned Numbers Authority, "Internet Key Exchange Version 2 (IKEv2) Parameters",<>.[MODES] Dworkin, M., "Recommendation for Block Cipher Modes of Operation -- Methods and Techniques", NISTSpecial Publication 800-38A, December 2001,</publications/nistpubs/800-38a/sp800-38a.pdf>.7.2. Informative References[RFC4303] Kent, S., "IP Encapsulating Security Payload(ESP)", RFC 4303, December 2005.[Recommendations] Barker, E., Barker, W., Burr, W., Polk, W., and M. Smid, "Recommendation for Key Management - Part 1: General (Revised)", NIST SpecialPublication 800-57, March 2007, <http:///publications/nistpubs/800-57/sp800-57-Part1-revised2_Mar08-2007.pdf>.Shen, et al. Informational [Page 5]Authors’ AddressesSean ShenHuawei4, South 4th Street, ZhongguancunBeijing 100190ChinaEMail: shenshuo@Yu MaoHangzhou H3C Tech. Co., Ltd.Oriental Electronic Bld., No. 2Chuangye RoadShang-Di Information IndustryHai-Dian DistrictBeijing 100085ChinaEMail: yumao9@N S Srinivasa MurthyFreescale SemiconductorUMA PLAZA, NAGARJUNA CIRCLE, PUNJAGUTTAHYDERABAD 500082INDIAEMail: ssmurthy.nittala@Shen, et al. Informational [Page 6]。

Polycom 产品说明书

Polycom 产品说明书

Why Polycom VoIP?• Polycom is the leading independent supplier of standards-based IP telephones.• To offer you a choice of end-to-end, integrated VoIP solutions , Polycom ensures that your Polycom phones are fully interoperable with leading standards-based IP PBX and Softswitch platforms 1.• Polycom’s comprehensive product portfolio encompasses the SoundPoint ®IP family of desktop phones, the attendant console based on the SoundPoint IP 601/650 and Expansion Module, and the SoundStation ®IP 4000 conference phone.Features and Benefits Outstanding Voice Quality• Polycom’s revolutionary HD Voice ™technology delivers voice communications of life-like interactivity, richness, and clarity*:- Exceptional sound quality, echo cancellation, and noise reduction - Support of G.722 wideband codec- Interactive two-way conversations that are as natural as being there- Polycom full-duplex 2speakerphones are compliant with IEEE 1329 standards • Network-related provisioning for superb voice quality:- Quality of Service – IEEE 802.1 p/Q, Layer 3 TOS, and DSCP 3- Dynamic jitter buffer- Sophisticated packet loss concealment algorithms Enhanced Call Handling, Security, and • Support of up to 24 simultaneous calls on up to 12 lines Advanced Applications 4, 5• Shared call / bridged line appearance • Busy Lamp Field (BLF)• Multiple call- and flexible line appearances• TLS security 3, encrypted configuration files 3, HTTPS secure provisioning 7, support of “signed” software executables 7, URL syntax for boot server address, and digest authentication•Microsoft ®LCS 2005 interoperability for telephony and presence 3- Compatibility with Microsoft Office Communicator and Windows ®Messenger 5.1 clients•XHTML micro-browser for productivity-enhancing Web-based applications 8Ease of Use• Polycom IP phones provide an easy transition from legacy PBX and Key Systems to the world of IP communications:- Intuitive user interface- Easy-to-read, high-quality LCD displays with up to 320x160 pixel resolution - A combination of up to 26 dedicated hard keys and up to 4 context-sensitive soft keys for one-touch access to essential featuresEfficient Installation, Provisioning, and Ugrades • Polycom IP phones are designed to make installation, configuration, and upgradesas simple and efficient as possible:- Centralized provisioning and upgrades from an FTP , TFTP , HTTP 7, or HTTPS server - Support of provisioning 3 and call server redundancy - Manual or DHCP set-up. Web configuration- Lower cabling expenses: dual-port 10/100 Mbps Ethernet switch for LAN and PC connection 9- Choice of powering options: AC adapter or Power over Ethernet Investment Protection• Polycom IP phones can be upgraded to new firmware in the field so as to consistently meet your business communication needs as protocols develop and standards evolve • Polycom IP phones are standards-based, so there is no need to replace them when upgrading or replacing your standards-based call server* Currently available on SoundPoint IP 650 and 550. In some calling scenarios, such as IP to PSTN, Polycom HD Voice will not be available and the call will progress in narrowband instead.1Please visit /techpartners.htm for a full list of supported IP PBX and Softswitch solutions.2The SoundPoint IP 301 has a monitor-only speakerphone.3Requires SIP version 2.0.x or higher.4Most features must be supported by the call server. Please contact your IP PBX / Softswitch vendor or service provider for a list of supported features.5Not all Polycom VoIP phones support all features. Please refer to the product documentation for details.7Requires BootROM 3.0.x or higher.8Not available on the SoundPoint IP 301.9The SoundPoint IP 320 and SoundStation IP 4000 have a single 10/100 Ethernet port.Polycom ®IP TelephonesQuick Reference GuideThe Power of a Network. The Simplicity of a Phone.7SoundPoint IP 550:Cutting-edge SIP feature set meets Polycom HD Voice■Application targets: manager's / professional's office ■4 lines■Integrated PoE support (IEEE 802.3af)■Polycom HD Voice for all audio paths■320 x 160 pixel backlit grayscale graphical LCD■26 dedicated hard keys, 4 context-sensitive soft keys ■SIPWW MSRP*: $369PERFORMANCEAt-a-GlanceRev. 03/07Polycom Headquarters:4750 Willow Road, Pleasanton, CA 94588 (T) 1.800.POLYCOM (765.9266) for North America only. For North America, Latin America and Caribbean (T) +1.925.924.6000, (F) +1.925.924.6100 Polycom EMEA:270 Bath Road, Slough, Berkshire SL1 4DX, (T) +44 (0)1753 723000, (F) +44 (0)1753 723010Polycom Asia Pacific:8 Shenton Way, #11-01 Temasek Tower, Singapore 068811 (T) +65.6389.9200, (F) +65.6323.3022© 2007 Polycom,Inc. All rights reserved.Polycom, the Polycom logo, SoundPoint and SoundStation are registered trademarks and HD Voice is a trademark of Polycom, Inc. in the U.S. and various countries. All other trademarks are the property of their respective companies. Specifications are subject to change without notice.* Subject to change without noticeSoundPoint IP 301:Entry-level two-linedesktop IP phone that delivers remarkable value■Application targets: common areas, warehouse ■2 lines■PoE support with optional cable ■Monitor-only speakerphone ■4 line x 20 character-based LCD■12 dedicated hard keys, 3 context-sensitive soft keys ■SIP , MGCPUS MSRP*: $180SoundPoint IP 501:Three-line desktop IP phone that delivers exceptional voice quality■Application targets: office, SOHO, hotel room ■3 lines■PoE support with optional cable■Full-duplex speakerphone with Acoustic Clarity Technology■160 x 80 pixel grayscale graphical LCD■24 dedicated hard keys, 4 context-sensitive soft keys ■SIP , MGCPUS MSRP*: $270SoundPoint IP 330 and 320:Entry-level IP phones with enterprise-grade features and outstanding voice quality■Application targets:- Cubicle, call center (SoundPoint IP 330)- Common areas, dorm rooms, wall-mounted deployments (SoundPoint IP 320)■2 lines■Integrated PoE support (IEEE 802.3af)■Full-duplex speakerphone with Acoustic Clarity Technology ■102 x 33 pixel graphical LCD■15 dedicated hard keys, 3 context-sensitive soft keys ■Two-port 10/100 Ethernet switch (SoundPoint IP 330)■Single 10/100 Ethernet port (SoundPoint IP 320)■SIPWW MSRP*: $179 (SoundPoint IP 330)$139 (SoundPoint IP 320)SoundPoint IP 430:Full-duplex speakerphone, built-in PoE, and a graphical LCD■Application target: cubicle ■2 lines■Full-duplex speakerphone with Acoustic Clarity Technology■Integrated PoE support (IEEE 802.3af)■132 x 46 pixel graphical LCD■16 dedicated hard keys, 4 context-sensitive soft keys ■SIPWW MSRP*: $239SoundPoint IP 601:Six-lines, advanced functionality, and Expansion Module support■Application targets: manager’s office, telephone attendant's desk■6 lines (standalone) / 12 lines (with Expansion Module)■Integrated PoE support (IEEE 802.3af and Cisco Inline Power)■Full-duplex speakerphone with Acoustic Clarity Technology ■320 x 160 pixel grayscale graphical LCD■26 dedicated hard keys, 4 context-sensitive soft keys ■Support of up to three Expansion Modules (SIP only)■SIP , MGCPUS MSRP*: $399SoundStation IP 4000:The clear IP conferencing solution■Full-duplex conference phone featuring Acoustic Clarity Technology■10-ft. microphone coverage expandable to 20-ft.x 30-ft. with optional extension microphones ■PoE support with optional PoE Interface Module ■248 x 68 pixel backlit graphical LCD ■SIPUS MSRP*: $1,099SoundPoint IP Expansion Module:Turn the SoundPoint IP 601/650 into a high-performance attendant console■Application target: telephone attendant's desk ■14 illuminated keys configurable as a line key, or a speed dial with BLF■160 x 320 pixel grayscale graphical LCD ■Plug-and-play, hot-swappable■Cord-free, no AC adapter required – power and signaling are provided by the host phoneWW MSRP*: $299SoundPoint IP 650:High-performance IP phone with Polycom HD Voice ™■Application targets: executive office■6 lines (standalone) / 12 lines (with Expansion Module)■Integrated PoE support (IEEE 802.3af)■Polycom HD Voice for all audio paths■320 x 160 pixel backlit grayscale graphical LCD ■26 dedicated hard keys, 4 context-sensitive soft keys ■Support of up to three Expansion Modules ■USB port for future applications ■SIPWW MSRP*: $449ENTRY-LEVELMAINSTREAMATTENDANTCONFERENCE。